Tighten session ticket handling

Tighten client-side session ticket handling during renegotiation:
ensure that the client only accepts a session ticket if the server sends
the extension anew in the ServerHello. Previously, a TLS client would
reuse the old extension state and thus accept a session ticket if one was
announced in the initial ServerHello.

Reviewed-by: Bodo Moeller <bodo@openssl.org>
(cherry picked from commit d663df2399d1d9d6015bcfd2ec87b925ea3558a2)

Conflicts:
	CHANGES

diff --git a/CHANGES b/CHANGES
index c20b87348920ba2ac62e2deb788f9637cb42202e..de1f0c9fb0a14cf65719b89f0ea0b65b4da05a9f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,12 @@
 
  Changes between 1.0.1j and 1.0.1k [xx XXX xxxx]
 
-  *)
+  *) Tighten client-side session ticket handling during renegotiation:
+     ensure that the client only accepts a session ticket if the server sends
+     the extension anew in the ServerHello. Previously, a TLS client would
+     reuse the old extension state and thus accept a session ticket if one was
+     announced in the initial ServerHello.
+     [Emilia Käsper]
 
  Changes between 1.0.1i and 1.0.1j [15 Oct 2014]
 

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 263e6348c978153142e3abd88a4526eac9fa3561..1e691b9a63d4c392d963f8fbdadf1b05dcd8cf61 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -225,6 +225,14 @@ int ssl3_connect(SSL *s)
                        s->renegotiate=1;
                        s->state=SSL_ST_CONNECT;
                        s->ctx->stats.sess_connect_renegotiate++;
+#ifndef OPENSSL_NO_TLSEXT
+                       /*
+                        * If renegotiating, the server may choose to not issue
+                        * a new ticket, so reset the flag. It will be set to
+                        * the right value when parsing ServerHello extensions.
+                        */
+                       s->tlsext_ticket_expected = 0;
+#endif
                        /* break */
                case SSL_ST_BEFORE:
                case SSL_ST_CONNECT:
@@ -2223,7 +2231,7 @@ int ssl3_get_new_session_ticket(SSL *s)
                }
        memcpy(s->session->tlsext_tick, p, ticklen);
        s->session->tlsext_ticklen = ticklen;
-       /* There are two ways to detect a resumed ticket sesion.
+       /* There are two ways to detect a resumed ticket session.
         * One is to set an appropriate session ID and then the server
         * must return a match in ServerHello. This allows the normal
         * client session ID matching to work and we know much 

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index ad40fadd02cc508b9a48691cc43514955154d316..235f92d824cd1e38bb4da59c55c49041e36c8379 100644 (file)
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -335,7 +335,21 @@ int ssl_get_new_session(SSL *s, int session)
                        return(0);
                        }
 #ifndef OPENSSL_NO_TLSEXT
-               /* If RFC4507 ticket use empty session ID */
+               /*
+                * If RFC5077 ticket, use empty session ID (as server).
+                * Note that:
+                * (a) ssl_get_prev_session() does lookahead into the
+                *     ClientHello extensions to find the session ticket.
+                *     When ssl_get_prev_session() fails, s3_srvr.c calls
+                *     ssl_get_new_session() in ssl3_get_client_hello().
+                *     At that point, it has not yet parsed the extensions,
+                *     however, because of the lookahead, it already knows
+                *     whether a ticket is expected or not.
+                *
+                * (b) s3_clnt.c calls ssl_get_new_session() before parsing
+                *     ServerHello extensions, and before recording the session
+                *     ID received from the server, so this block is a noop.
+                */
                if (s->tlsext_ticket_expected)
                        {
                        ss->session_id_length = 0;